Server restarts every night

[hfnistelrooy]

Hi all,

 

My server keeps restarting itself every night at 3am and 6am.

 

I have checked the minidumps using the bluescreen viewer and it is reporting the following error on all the restarts:

 

KMODE_EXCEPTION_NOT_HANDLED - ntoskrnl.exe+7f190 and sometimes the mrxsmb10.sys

 

I have run a virus scan and the server is clean, the server installed some .net 4 updates before this started but I have uninstalled them all and it is still happening

 

Any ideas?

 

Thanks

[Guest M0MST]

Just check in scheduled tasks, see if there is anything set to happen at those times.

 

It looks like its based around windows file sharing

 

List of currently available hot fixes for the File Services technologies in Windows Server 2008 and in Windows Server 2008 R2

 

That may be a good starting point, However if you run windows update I wouldn't have thought it would be an issue.

[VeryPC_Ed]

Hi hfnistelrooy,

 

Can you look in c:\windows\minidump and see if there are any minidump.xml files for around the time when your server is crashing.

 

If you can send me some over (my email in my sig), I'll happily debug a few and see if I can locate the exact cause.

 

Ed

[RabbieBurns]

Just check in scheduled tasks, see if there is anything set to happen at those times.

 

It looks like its based around windows file sharing

 

List of currently available hot fixes for the File Services technologies in Windows Server 2008 and in Windows Server 2008 R2

 

That may be a good starting point, However if you run windows update I wouldn't have thought it would be an issue.

 

Hotfixes dont get installed as part of windows updates do they. I thought hotfixes had to be done manually?

[hfnistelrooy]

thanks for the updates guys, ill remote into the server tomorrow and get the minidumps and see if the hotfix helps

[VeryPC_Ed]

Hi there,

 

I was wondering if you got anywhere with this ?

 

I got the minidumps and thought I had replied to your email back in Dec (apparantly not though !) but from looking at the dumps it seems that savservices.exe (Sophos) is what is causing the restarts.

 

I'd check your Sophos is up to date or if it's scanning something at that time as it could be either program fault or maybe some its scanning killing it.

[ricki]

Hi

 

There appears to be several people with this people and people are advising

 

Antivirus check

Malware bytes check

Mem test

Hard drive check

Windows updates

Latest drives.

Raid check

system file check

 

The mini dump may help.

 

Also if its a hp server see on there site if there are any critical patches.

 

Richard

Edited January 11, 2013 by ricki

[hfnistelrooy]

Hi there,

 

I was wondering if you got anywhere with this ?

 

I got the minidumps and thought I had replied to your email back in Dec (apparantly not though !) but from looking at the dumps it seems that savservices.exe (Sophos) is what is causing the restarts.

 

I'd check your Sophos is up to date or if it's scanning something at that time as it could be either program fault or maybe some its scanning killing it.

 

mmm im still experiencing restarts but did not see anything related to Sophos on the minidumps. I kept getting the mrxsmb10.sys errors. I will check to see if Sophos is scanning anything that it shouldnt

[ricki]

Have you seen this.

 

Win 2008 32bit Random BSOD mrxsmb10.sys (Network Steve Forum)

 

Richard

[hfnistelrooy]

Yep installed load of hotfixes and it did not restart for 2 weeks and then yesterday bang! crash at 2am and 4am both according to blue screen view was caused by the mrxsmb10.sys file

 

pulling my hair out

[staningrimsby]

Is there anything showing in event viewer at all ???

[Michael]

I had a very similar problem recently. It was due to the APC UPS performing a self test every two weeks (the default) causing the server to be totally unresponsive.

[hfnistelrooy]

in the event viewer all i get is the BSOD code and nothing to indicate why it has crashed, the timings are purely random. sometimes the server will restart every night and other times go on for 3 days before the next crash.

 

I will have a look at the APC software but if it is running its self test every 2 weeks I would be expecting the server to crash every 2 weeks?

[markcuk]

do you have any iscsi devices connected to the server?

 

I had a BSOD just last week when the Iscsi target dropped off the network

[hfnistelrooy]

nope no iSCSI devices connected to the server.

[Duke5A]

Yep installed load of hotfixes and it did not restart for 2 weeks and then yesterday bang! crash at 2am and 4am both according to blue screen view was caused by the mrxsmb10.sys file

 

pulling my hair out

 

I'm wondering if hotfixes fixed your original problem, but mrxsmb10.sys was replaced again back to an older bugged version through an update or sort. I'd check the version of this file against the one included in the hotfix. This system file is basically responsible for handling SMB 1.0 traffic. Windows 2k through Server 2003 R2 used SMB 1.0. There has to be some kind of scheduled connection either going out of that server, or into it using SMB 1.0 at the crash time.

[hfnistelrooy]

I had a look at the mrxsmb10.sys version which is currently v6.1.7601.22033, according to the following page it looks like it is the latest version

 

Computer stops responding after you connect to an SMB 1 server in Windows 7 or in Windows Server 2008 R2